Looking for an All-in-One Mac-Based Server Solution?
4D WebSTAR V: A bundle of Mac-OS-X-based Web, FTP, WebDAV, and mail servers aimed at small to midsize enterprises
Imagine handling the internet presence for the U.S. Army, where Web security literally means national security. WebSTAR has staunchly defended http://www.army.mil since 1999, after hackers exploited IIS holes to deface the Web site. For nervous grunt technicians, the Mac OS and WebSTAR made secure replacements. "In general," the W3 Consortium summarized at the time, "the more powerful and flexible the operating system, the more open it is for attack through its Web (and other) servers."
Mac OS X's Unix shell boosted the Mac's power and flexibility, but it has also called its de facto security into question. Jaguar's vulnerabilities are causing many administrators to consider OS X 10.3 "We have customers using [it]," said 4D's Luke van der Westhuyzen, "but we are still not confident enough about Panther to say that it is recommended for use with 4D WebSTAR V." Full Panther support is sure to come, but against this shifting background, should WebSTAR be the Web server of choice for security-minded admins?
Apache's inclusion in OS X has made it the contender to beat on the Mac. 4D and competitor Tenon Intersystems responded with GUI suites that aim for classic Mac ease of use atop BSD flexibility. While Tenon based its iTools products on Apache, 4D WebSTAR stuck to its own Web server, which has proven itself nominally faster than Apache in MacWorld tests. It forms the core of the WebSTAR's Internet server: a bundle of Web, mail, FTP, and WebDAV servers for small-to-midsize enterprises.
Choosing WebSTAR over the open-source stalwart Apache means eschewing the world's most widely deployed server. Novice admins in Mac-dedicated shops may still want to consider it for its quicker ramp-up time, ease of installation, and rich feature set. For more seasoned admins, WebSTAR allows the delegation of mundane tasks; individual sites can be separately administered by users with restricted access.
Exploring the Suite
WebSTAR's Web server is configured for SSL out of the box and features newly flexible realm management. Its plug-ins support CGI, Fast-CGI, and PHP. Linking Tomcat to provide JSP support is simple, and 4D's database is easily integrated. Cool extras range from a Filemaker Connector to Rewrite, which enables Regular-Expression-based dynamic URL modifications.
Using WebDAV is a snap. To see for yourself, take an existing realm and turn on WebDAV for it. This feature may be of particular interest to the Army, which recently had hackers gain unauthorized access to a different Windows 2000 server using WebDAV holes.
A Mac/Windows Java-based admin client allows complete remote configuration. It enables hackers who have learned the password and procured client software to "administer" the server from anywhere. Configurable IP ranges for server administration resolve this shortcoming.
The FTP server can map users to distinct roots and features extensive logging. Some buffer overflow security problems were reported in v5.3.1, and in v5.3.2 FTP security was slightly beefed up.
Although the fledgling mail server component is becoming more robust (it now features Beyesian spam filtering, virus checking, improved SMTP authentication, and Entourage IMAP compatibility), it still lacks the comparative feature depth and time-testedness of WebSTAR's Web server.
Determining whether you'll love or leave 4D WebSTAR's vast array of features is easy. The basic installation process takes about five minutes. An eval copy is available at http://www.4d.com/products/webstar/trialdownload. The full-featured demo runs for two hours at a time; restarting the server provides an automatic extension. A minimum Mac OS X 10.2 system with 128 MB of RAM is required. A G4 or G5 running OS X 10.2 with 256 MB of RAM and a DSL or faster connection is recommended.
Installation is simple. First, create a 'webstar' account under System Preferences/System/Accounts, which differentiates between system and Web server administration for security purposes. Then, disable Apple's built-in Web services under System Preferences/Internet and Network/Sharing.
Now, run the installer; choose Easy Install. Logout, then login as the 'webstar' user. Under Applications/4DWebSTAR, open the 4D WebSTAR Launcher. This spawns both the 4D server suite and the Java-based admin client. Once you've loaded http://127.0.0.1:80 in a browser, you're in business!
Modifying the site is fairly Apache-esque: Modify index.html and other files under 4DWebSTAR/WebServer/DefaultSite while logged as 'webstar.'
WebSTAR tows the line nicely between simplicity and power.
For the future ...
By including a mail server, 4D has wedged WebSTAR into a space between groupware servers and Web suites. Along these lines, a collaboration between SoftArc and 4D to produce an Apache-based fusion of WebSTAR and FirstClass would be an administrator's dream come true. Meanwhile, as software companies endeavor to create products with the multifunctionality of Swiss army knives to survive in a shifting market, admins are left with a full toolbox.
Alternately, from a business opportunity perspective, despite venture capital directives that companies must diversify products to survive, Wall Street's salivation over Google presents a different story. Success also goes to enterprises that pick one application and get it exactly right, especially when it is an application that enough people have a use for. In that vein, 4D WebSTAR V will appeal to enterprises that want to view Internet and mail serving as a single application.
Pros: Easy to use; Feature-rich; Strong Web and WebDAV servers
Cons: Non-Apache based; Less-robust mail server; Potentially less secure
Reviewed by: Ben Freeman
Original Review Date: 1/30/2004
Original Review Version: 5.3.2